TraderTraitor Binance Heist: FBI Names North Korean Group

The FBI has attributed the $6.43 billion Binance theft to TraderTraitor, the North Korea-aligned group also tracked as Jade Sleet and UNC4899. The attribution names the attacker but not the way in, so Cyprus crypto firms have to screen funds now and test the paths this group has used before.

What did the FBI attribute, and to whom?

The FBI says TraderTraitor, a North Korea-aligned hacking group, stole the Binance funds. The bureau announced the attribution on November 1, 2026, together with the U.S. Secret Service and IRS Criminal Investigation (IRS-CI), and published a list of wallet addresses it says the attackers are using to launder the proceeds.

The dates matter. The drain happened on October 29; the attribution came three days later. This piece covers what the attribution adds: the actor, the freezes, the laundering route and the group’s known methods. For the theft itself, see our report on the October 29 hot-wallet drain.

TraderTraitor is a familiar name to anyone who follows exchange thefts. Security vendors track the same cluster as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899. Its methods overlap with two other North Korean recruitment campaigns: Lazarus Group’s Operation Dream Job and Famous Chollima’s Contagious Interview.

The group has targeted the Web3 industry since at least 2020, typically by persuading employees to download and run malware-laced applications. Earlier heists attributed to it include DMM Bitcoin, Bybit, KelpDAO and Bitget.

The FBI has not said how the attackers got in. There is no published intrusion vector, no named compromised system and no root cause. Tracing firms described test withdrawals and a rehearsal hours before the main outflow. The attribution adds a name to that timeline, not a mechanism. Keep the two in separate paragraphs of any internal briefing.

How large is the TraderTraitor Binance heist next to Bybit?

At $6.43 billion, the TraderTraitor Binance heist is the largest cryptocurrency theft on record, more than four times the $1.46 billion taken from Bybit in February 2025. The figure needs one caveat: the reporting uses $6.43 billion in its headline and “more than $6 billion” in the body, while other outlets, and our own first-day coverage, used about $6.3 billion. All are tracing estimates, not an audited Binance number.

The funds came from 11 blockchains, one more than the “at least ten” counted in the first hours. About 82% of the stolen value sat on Ethereum and Bitcoin, which shapes what can and cannot be recovered, as the next section explains.

Elliptic, the blockchain analytics firm, estimates that DPRK-linked actors have stolen more than $6.5 billion in cryptoassets in recent years. Its verdict on Binance: “This single incident almost doubles the total cryptoassets stolen by the regime.”

The two largest crypto thefts on record, Bybit and Binance, are now both attributed to the same group, less than two years apart. Any Cyprus firm that models DPRK actors as a niche risk should revisit that assumption.

Where is the stolen money now, and how much is frozen?

About $2.85 billion has been frozen on-chain, roughly 44% of the total. The freezes came from Tether, Circle, Ripple and the two Ethereum layer-2 networks Arbitrum and Optimism. The FBI says it has observed the attackers converting the remaining, unfrozen funds, about $3.6 billion, mainly into Ethereum.

A freeze does less than the term suggests. A stablecoin issuer can block listed addresses through its token contract, so USDT or USDC at those addresses stops moving. That does not reverse the theft. Getting money back to Binance still depends on legal process and on the cooperation of whoever controls the asset.

The 82% Ethereum and Bitcoin share does not make those funds freezable. A token on Ethereum can be frozen only if its issuer built that control into the contract, as Tether and Circle did. Native ether, like bitcoin, has no such switch. Early tracing by Elliptic found the frozen portion was almost entirely stablecoins.

The FBI’s outlook on the next stage is direct: “It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.”

Converting to ether does not erase history. Ethereum transactions are public. Bridges, swaps and long chains of fresh addresses slow tracing, but every hop is an observable event and a point where a regulated service provider in Cyprus can refuse, hold or report.

Address screening checklist for Cyprus CASPs and EMIs

We are not reproducing the FBI’s addresses here. Pull them from the FBI publication or from your analytics provider, then:

1. Load the list into wallet screening and transaction monitoring today. Record the date and source of the list version you loaded, so you can show a supervisor when screening started.
2. Screen retrospectively from October 29. Check deposits, withdrawals and internal transfers against the list, including indirect exposure one or two hops away, not only direct matches.
3. Treat the list as a snapshot. Laundering moves funds to new addresses constantly. Make sure your analytics vendor is pushing updated clustering for this incident, and re-run screening as updates arrive.
4. Review swap and bridge counterparties. The FBI named DeFi and instant swap services as the next stage. Look at inbound flows routed through such services since the theft, especially ETH arriving shortly after a swap.
5. Act on a hit. Hold the funds under your policy, preserve the transaction records and analytics output, and file a suspicious transaction report with MOKAS, the Cyprus financial intelligence unit. Notify the relevant stablecoin issuer if the funds involve tokens it can freeze.

Are Binance withdrawals working again?

Yes, Binance says withdrawals have resumed after a pause that began with the incident. Deposits never stopped. In the exchange’s words: “We aim to restore withdrawals progressively as we complete security and readiness checks. Deposit services remain open and are not affected by the incident.”

Phase one went live between 06:00 and 09:00 UTC on November 1, 2026. Binance said its teams had “taken precautionary measures to safeguard the platform, conducted security assessments, and worked to verify the readiness of affected services.”

A later update said withdrawals were back for all 15 networks, while the same update said teams were still testing remaining networks and assets. The two statements sit uneasily together, and Binance has not clarified whether other networks remain pending. Firms holding assets on Binance should check each network and token before assuming normal service.

What the withdrawal rush tells you

Between 06:00 and 15:30 UTC on November 1, Binance processed $4.649 billion in withdrawals against $1.01 billion in deposits. That is a net outflow of about $3.64 billion in the nine and a half hours after reopening, leaving the exchange down $3.64 billion in customer withdrawals within a single morning and early afternoon. The figure is more than half the theft.

For a Cyprus CASP, that number belongs in a stress scenario. If a major counterparty pauses withdrawals, can you still meet your own customers’ requests? And if you are the one who pauses, how much leaves when you reopen?

How does TraderTraitor usually get in?

TraderTraitor usually gets in through people, not perimeter flaws: it approaches engineers and other staff with fake job offers, then gets them to run code. Reports from Microsoft, SentinelOne and Zscaler ThreatLabz describe the current version of this playbook. None of it is confirmed as the Binance entry point. It is the group’s documented history, and it tells you where to look in your own firm.

Recruiters that do not exist

Fake recruiters and front companies contact people working in cybersecurity, AI, blockchain and talent recruitment. The job interview is the pretext. At some stage the candidate is asked to clone a repository, run a test project or install a tool. According to the reporting, AI now helps the group write convincing lures and build fake personas.

Microsoft described one such front: a spoofed “AI-powered blockchain intelligence company” supported by “tailored domains, social media profiles, and industry-specific knowledge,” offering software engineer roles to anyone who replied. Within a short time frame, Microsoft said, Jade Sleet ran two more front companies with comparable infrastructure. These are personas built to survive a LinkedIn check and a technical conversation.

Trojanized Terraform providers

The newer twist targets infrastructure engineers. Terraform providers are plugins that let Terraform manage a cloud or service. TraderTraitor has distributed poisoned providers that drop a Bash loader. The loader checks the victim’s operating system and fetches matching malware for macOS, Linux or Windows.

The first payload is FLATROOF, a cross-platform implant that uses a Python-based information stealer to collect sensitive data. ROOFDECK, a backdoor for full remote control, follows. On a DevOps laptop, “sensitive data” means cloud credentials, SSH keys, Terraform state and CI tokens. That is often enough to reach production without fooling a second person.

Terraform’s lockfile does not solve this. The .terraform.lock.hcl file records provider versions and package hashes, which helps you spot unexpected changes. It cannot tell you a provider was malicious from its first release. A matching hash only confirms you installed the trojanized package faithfully.

The precedent that shows the full path

The DMM Bitcoin theft of May 2024 is the clearest public example. Japanese police and the FBI said it began when a fake LinkedIn recruiter contacted an employee of Ginco, a crypto-wallet software supplier, and sent a malicious Python script framed as a pre-employment test. The breach started at a supplier and ended in the exchange’s wallets.

One employee endpoint, outside the victim’s own walls, led to the funds. That is the pattern worth testing against, whatever the Binance root cause turns out to be.

What should a Cyprus CASP do with the FBI Binance attribution?

Treat it as two jobs: compliance work on the stolen funds now, and testing of the exposure TraderTraitor has exploited before. Cyprus hosts many CASPs authorized under MiCA and EMIs supervised by the Central Bank of Cyprus, and most hold assets on large exchanges or run hot wallets of their own.

Reporting duties do not wait for a root cause

If a similar event hit your firm, DORA reporting would start long before anyone understood the intrusion. For a major ICT-related incident, the initial notification is due within four hours of classification and no later than 24 hours after you become aware of it. An intermediate report follows within 72 hours, and a final report within a month. DORA has applied since January 17, 2025.

A global exchange promising to cover losses does not change your own classification and reporting duties under MiCA and DORA. Know your recipients in advance: CySEC or the Central Bank of Cyprus under DORA, the Digital Security Authority and CSIRT-CY under NIS2 where in scope, the Data Protection Commissioner under GDPR, and MOKAS for suspicious transactions. Write those contacts into the incident runbook.

Controls worth testing while the vector is unknown

Practitioner’s note. In engagements with crypto and fintech clients, the gap we find most often is not a missing firewall rule. It is a developer laptop holding a live cloud session, a cached SSH agent and access to the signing service’s deploy pipeline at the same time. When we start a test from that laptop, the question “can one engineer’s machine move customer funds?” usually gets answered within days. If a recruitment task has already run on such a machine, assume its credentials are exposed and rotate them before you delete the repository.

• Recruitment tasks as code execution. Any coding test, sample project or tool sent by an external “recruiter” runs in a disposable VM with no corporate SSO session, SSH agent, cloud credentials or password manager. Extend this to employees who are job hunting on the quiet; they will not tell you.
• Provider and dependency allowlists. Pin Terraform providers to approved publishers, review new providers before first use, and block installs from unknown registries on build agents and laptops.
• Developer credential blast radius. Short-lived cloud credentials, hardware-backed SSH keys, and no standing production access from engineering laptops.
• Signing and withdrawal limits. Hot-wallet balances sized to daily need, velocity limits that one person cannot lift, and alerts on test withdrawals to new destinations. The rehearsal before the October 29 drain is exactly the signal those alerts exist to catch.

A DORA threat-led penetration test can model this actor end to end: recruiter pretext, poisoned dependency, then lateral movement toward signing. Firms below TLPT scope can run a targeted social engineering assessment aimed at engineers and HR, and pair it with MiCA and CASP penetration testing of wallet and withdrawal logic. Our earlier piece on what Cyprus CASPs must test after the Binance hack covers the signing side in more depth.

What is still unknown about the Binance breach?

The intrusion path is the biggest unknown: nobody has published how TraderTraitor reached Binance’s hot wallets. We do not know whether a person, a supplier, a build pipeline or the signing system itself was the first foothold, or whether the recruiter and Terraform techniques above played any part.

Other open questions:

• The final figure. $6.43 billion and $6.3 billion are both in circulation. Neither is a Binance-confirmed audited loss.
• Recovery. $2.85 billion is frozen, but frozen is not returned. How much reaches Binance depends on issuers and courts.
• Restoration scope. Binance says all 15 networks are back and also that testing continues on remaining networks and assets, without saying which.
• Laundering speed. The FBI expects swaps and DeFi next. How quickly the unfrozen $3.6 billion moves will decide how long screening lists stay useful.

Until Binance or the FBI publishes technical detail, the honest position for a Cyprus firm is simple: screen the funds, prepare the reports, and test the paths this group has used against others.

FAQ

Who is TraderTraitor and did they hack Binance?

TraderTraitor is a North Korea-aligned hacking group active since at least 2020 that targets crypto and Web3 firms. The FBI attributed the Binance theft to it on November 1, 2026, but has not published how the breach was carried out.

How much was stolen in the Binance crypto heist?

Reports put the theft at $6.43 billion, with some outlets citing about $6.3 billion. The funds were taken across 11 blockchains, with 82% of the value on Ethereum and Bitcoin.

Is the Binance theft bigger than the Bybit hack?

Yes. At $6.43 billion it is more than four times the $1.46 billion stolen from Bybit in February 2025, a theft also attributed to TraderTraitor.

How much of the stolen Binance crypto is frozen?

About $2.85 billion has been frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism. Native bitcoin and ether have no issuer freeze, so most of the remaining value is still movable.

Are Binance withdrawals working again?

Binance began restoring withdrawals in phases at 06:00 UTC on November 1, 2026 and later said all 15 networks were back, while also saying testing continues on remaining networks and assets. Check each network and token before relying on it.

What should crypto firms do after a DPRK attribution?

Load the FBI's published wallet addresses into screening, check transactions back to October 29, and report hits to MOKAS. Then test recruitment-lure exposure, developer credential scope and hot-wallet withdrawal limits.

If you want to know how far one compromised engineer’s laptop could reach toward your wallets, our DORA threat-led penetration testing team can model a TraderTraitor-style intrusion against your own controls.